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APOLLO EXPERIENCE REPORT 

LUNAR MODULE INSTRUMENTATION SUBSYSTEM 

By David E. O'Brien 111 and Jared R. Woodfill IV 
Manned Spacecraft Center 

SUMMARY 


The lunar module instrumentation subsystem processes approximately 250 meas- 
urements during each mission for display, caution and warning, and telemetry. These 
measurements include analog measurements (pressure, temperature, and quantity) and 
discrete measurements (switch closures and step voltages). Some problems were en- 
countered with the various components of the subsystem from manufacturing through 
preflight checkout, but the subsystem performed well in flight. The only inflight prob- 
lems were broken spacecraft wires going to the lunar module 5 data storage electronics 
assembly and to a pressure transducer on lunar module 4, noticeable data shifts on 
two lunar module 4 pressure transducers and a lunar module 3 water quantity measuring 
device, and nuisance caution and warning alarms. The primary preflight problems 
were pressure transducers shifting off calibration (usually less than 5 percent), water 
quantity measuring devices shifting off calibration (3 to 10 percent), and interface prob- 
lems involving the signal conditioning electronics assembly. The pressure transducers 
were redesigned to alleviate the shifting problem. Modifications to the interface cir- 
cuits were required to overcome the signal conditioning and nuisance caution and warn- 
ing alarm problems. 


INTRODUCTION 


The lunar module (LM) instrumentation subsystem monitors the LM subsystems 
during preflight and inflight activities and prepares the data for entry into the pulse 
code modulation and timing electronics assembly (PCMTEA) and subsequent transmis- 
sion to the Manned Space Flight Network (MS FN). In addition, critical parameters are 
monitored for out -of -tolerance conditions, and voice and time -correlation data (TCD) 
are stored for recovery after the return to earth. 


DISCUSSION 

The LM instrumentation subsystem consists of a signal conditioning electronics 
assembly (SCEA), a caution and warning electronics assembly (CWEA), a data storage 
electronics assembly (DSEA) , and transducers (fig. 1) . Each ofthese components is 
discussed separately in the following sections. 
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Figure 1. - Lunar module instrumentation subsystem. 


Signal Conditioning Electronics Assembly 

The SCEA converts all unconditioned transducer (sensor) signals and events with 
one or more of its seven basic subassemblies to the proper voltage levels required by 
the PCMTEA, CWEA, and displays. Isolation also is provided between the CWEA and 
the other users of a shared signal. The seven basic subassemblies are dc amplifiers, 
dc attenuators, ac-to-dc converters, analog and discrete isolating buffers, frequency- 
to-dc converters, resistance -to -dc converters, and phase -sensitive demodulators 
(figs. 2 to 11). The SCEA consists of two chassis called electronic replaceable assem- 
blies (fig. 12), each of which has a capacity of 22 subassemblies. The electronic re- 
placeable assembly (ERA) provides the interface connections between the subassemblies 
and the unconditioned signals. Each subassembly can be replaced easily with another 
subassembly of the same type, even after the ERA has been installed in the flight 
vehicle. 
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Figure 2. - Power supply in each SCEA subassembly. 
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Figure 6. - Analog signal isolating buffer 504-1. 
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Figure 7. - Discrete signal isolating buffer, 504-2. 
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Figure 8. - Signal isolating buffer 504-3,4,5 
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Figure 9. - Frequency -to -dc converter 505-1 
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Figure 11. - Phase -sensitive demodulator 507-1 
























This concept of plug-in subassem- 
blies with point-to-point wiring (subassem- 
bly plug-in connector to the unconditioned 
signal -input connector) in the ERA was de- 
veloped through consultation among NASA 
personnel, LM contractor personnel, and 
command module contractor personnel who 
designed the command and service module 
signal -conditioning equipment. This design 
was required (1) to vary the mix of each 
circuit according to the requirement of 
each vehicle, (2) to replace a minimum of 
hardware in case of a failure, (3) to pro- 
vide accessible gain and zero adjustments, 
(4) to achieve minimum weight and power 
and maximum reliability, and (5) to adapt 
to the shape dictated by the space in the aft 
equipment bay. Much of this flexibility was 
lost, however, during a weight-saving pro- 
gram that resulted in removal of all spare 
wiring. The removal of the spare wiring requires that wires be added or rerouted (or 
both) whenever an ERA subassembly is replaced with another type of subassembly or 
whenever a subassembly is added to an ERA spare location. The signal -conditioning 
requirements for the remaining vehicles were supposedly firm when this decision was 
made, but subsequent requirement changes have been costly to implement because of 
the charges for retention of personnel to perform the work and the acceptance test pro- 
cedure (ATP). 

The circuits were designed according to the following ground rules. 

1. No ground or common loops in the instrumentation subsystem 

2. Minimal fault propagation 

3. Multirange capability for each subassembly 

These ground rules required that the SCEA provide isolation between the CWEA and 
PCMTEA (both grounded systems), isolation between the monitoring systems (CWEA, 
PCMTEA, and displays) and grounded sources (batteries and transducers), and isola- 
tion between the battery ground and the signal ground. A further requirement was that 
the SCEA be designed to protect the CWEA from the effect of failures in the pulse code 
modulator (by a short across an output or a failure in a circuit) and that each subassem- 
bly be capable of accepting signals with a variety of ranges. 

To accomplish the requirements established by these ground rules, isolation 
transformers, independent power supplies in each subassembly, and trim potentiom- 
eters were needed in the complex circuits. Approximately 16 500 parts are required 
for each SCEA to provide 266 channels of signal conditioning. 



(6 each end) 

Figure 12. - Electronic replaceable 
assembly. 


8 


In manufacturing these subassemblies, welded cordwood construction (with full 
encapsulation in potting) was chosen because this method provides the highest packing 
density and reliability. The only problems involved with the manufacturing were those 
resulting from the extremely high packing density of the modules. 

With so many welds, it was easy to overlook one or more, and it was difficult for 
the inspectors to find any manufacturing errors. This situation resulted in many re- 
worked units and a delay in the deliveries. Only nominal piece -part failures occurred 
during the qualification tests and in flight. The most significant of these failures were 
shorted transformers and cracked Mepco resistors. An additional thermal cycle was 
incorporated into the ATP to identify these weak components. 

Some difficulties arose during the vehicle/instrumentation-subsystem integration. 
One of the most difficult problems involved the discrete buffer that monitors the reac- 
tion control subsystem (RCS) thruster commands in the attitude and translation control 
assembly (ATCA) (fig. 13). The discrete buffer is designed to monitor either mechan- 
ical or solid-state switch closures. The buffer gives a 5 -volt ON signal when the re- 
sistance across mechanical contacts drops below 120 000 ohms or when the voltage 
across a solid-state switch drops below 4 volts with a corresponding drop in resistance. 
The firing command is given in the ATCA by grounding the low side of a solenoid through 
a transistor switch. The inputs of the discrete buffers are connected across the tran- 
sistor so that, when the system is activated, the buffer input senses 28 volts until a 
firing command is given; then, voltage drops to zero and the buffers produce a 5 -volt 
ON output signal. The problem arose when the solenoid circuit breaker was open and 
no voltage was present across the transistor and buffer inputs. The high emitter -to- 
collector resistance normally prevents the buffer from giving the ON signal. However, 
during these periods of no voltage on the transistor, the buffer would occasionally out- 
put the 5 -volt ON signal. This problem was attributed to noise on the power ground to 
which one side of the buffer was connected. This connection was moved to signal ground, 
and the other input remained on the high side (emitter) of the transistor. 




SCEA 


Signal ground 


5 V * ON PCMTEA 


Figure 13. - Discrete buffer, showing the lead to power ground rerouted 

to signal ground. 
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After this change, RCS tests were performed at the White Sands Test Facility 
(WSTF), and a new problem appeared in the form of short -firing indications. The 
buffer would give the ON command and then go OFF after a few seconds while the ATCA 
was still firing the thrusters. The cause of this problem was traced to the setup at the 
WSTF. The ATCA and the SCEA were located in the blockhouse, and command wires 
were routed to the pad where the thruster and the electrical power were located. 
Therefore, the ground wire leading from the collector of the transistors was approxi- 
mately 200 feet in length (fig. 14). When the firing command was given, the voltage at 
the transistor dropped to zero, but rose to 6 volts as the current through the solenoid 
increased. This 6 -volt rise was caused by the IR (current x resistance) drop across 
the 200 -foot ground lead. If the buffer had been connected in the original configuration, 
with its low side on the collector instead of on signal ground, this short -firing indica- 
tion would not have occurred. Only a small (0. 5 volt) drop across the transistor rather 
than the 6 -volt drop between the transistor and the battery ground would have reached 
the buffer. No modification was made to the WSTF test setup after the problem had 
been identified. 



Figure 14. - Discrete buffer, showing how the 200 -foot ground lead produced a 
+6-V dc potential between SCEA and signal ground. 


Meanwhile, the first problem (spurious jet firing) still was occurring occasionally. 
Further investigation revealed that some of the ATCA transistors had a low emitter -to - 
collector resistance of approximately 120 000 to 130 000 ohms. This low resistance, 
with noise on the power ground, was sufficient to trigger the buffer into the ON state 
sporadically. With the new information, the low side of the buffer input was returned 
to the collector side of the transistor, and a 50 000 -ohm resistor was placed between 
the SCEA circuit breaker and the emitter side of the ATCA transistor (fig. 15). This 
resistor formed a voltage divider whenever the SCEA was energized and maintained 
approximately 18 volts across the buffer input until the transistor switched on and the 
voltage dropped to approximately 0. 5 volt. The current through the resistor and tran- 
sistor was negligible with the transistor on or off. This arrangement proved to be a 
satisfactory fix for the interface incompatibility. 

The first problem occurred again when the open -contact resistance of a relay de- 
creased with usage until it reached the 120 000-ohm level and triggered the buffer on. 
This condition was eliminated in a similar manner. 
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Figure 15. - Discrete buffer, showing how a 50 000 -ohm resistor between SCEA power 
and ATCA transistor produced approximately 18 V dc when transistor was off. 


The worst prelaunch vehicle problem with the SCEA involved intermittent failures. 
Some instances occurred when measurements that were inexplicably bad for a short 
time cleared up before the defective item in the measurement link could be identified. 
Extensive testing of the suspected components was required to repeat the failure. Some 
of the SCEA subassemblies underwent several thermal vacuum tests and many thousands 
of operational cycles before they would repeat a failure mode. Overall, there were few 
prelaunch vehicle problems at the NASA John F. Kennedy Space Center and no inflight 
failures of the SCEA. 

The basic design concepts and the resulting SCEA have proved adequate to satisfy 
the signal -conditioning requirements of the LM instrumentation. The only major draw- 
back to the present SCEA is the lack of flexibility in subassembly arrangement in the 
electronic replaceable assemblies. When the weight-saving campaign resulted in re- 
moval of all wiring not being used for existing circuits, the type of subassembly for a 
given location was fixed, and the spare locations were useless. Although the majority 
of the signal -conditioning requirements have remained unchanged, some of the spare 
locations and all of the unused subassembly channels should have been kept fully wired 
to meet new requirements. In addition, there should be a means of changing the ranges 
of the resistance -to -dc converters without reworking either the subassembly or the ERA. 
The changes caused by new requirements and the range of the resistance -to -dc convert- 
ers have been very costly because of this inflexibility. 


Caution and Warning Electronics Assembly 

The concept of a real-time monitoring system to provide the LM crew caution and 
warning signals by an alarm tone and master -alarm indicator light evolved in 1965. An 
approach was taken in which the most critical parameters would be processed by a sin- 
gle unit called the CWEA (fig. 16). Software requirements for the logic of the unit 
(which included inhibits, enables, and level detectors) were determined through coor- 
dination with the LM subsystem engineers for the critical subsystems. A vendor was 
selected on the basis of technical and production capability and proximity to the LM 
contractor. Welded cordwood construction was selected as the fabrication and packaging 
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Figure 16. - Caution and warning 
electronics assembly. 


technique for the CWEA, and a subcon- 
tractor was selected by the vendor to pack- 
age the 29 logic components. A second 
subcontractor was chosen to manufacture 
the relay component and the four power - 
supply components. The final construction, 
including the completed assembly and test- 
ing, was accomplished by the vendor. 

The design of the CWEA box included 
such salient features as accessible trim- 
level resistors to facilitate trip-level mod- 
ifications after final CWEA unit assembly; 
the use of switch -closure relay outputs in 
place of solid-state closures (to eliminate 
system electrical -interface problems); a 
redundant power supply; and a triple redun- 
dancy with majority -voting logic, micro - 
circuit counter logic in a selected number 
of channels, and flip-flop resettable logic 
for one -third of approximately 100 inputs. 
The redundant power supply and the redun- 
dancy voting logic were eliminated as an 
LM weight -saving measure. 


Parts vendors were selected by the CWEA vendor to provide the 3000 parts for 
each CWEA. All parts requests were processed and approved by the LM contractor, 
with NASA concurrence. A major testing program was conducted to evaluate relays, 
and a miniature Wabco type was selected. 


A program of monthly meetings was established at the vendor facility to permit 
periodic discussion of technical problems, delivery -status monthly progress, costs, 
manpower, and testing by LM contractor representatives, NASA engineering represent- 
atives, and others related to the current program problems. During these meetings, 
many problems were solved through the coordination of experienced LM contractor, 
vendor, and NASA engineers who traded ideas and suggested solutions to problems. 

In 1966 and 1967, delivery of the CWEA became the pacing item for total LM com- 
pletion as defined by the Program Evaluation and Reporting Technique network instituted 
by the LM contractor. Production was expedited at the vendor facility, and the design 
verification test (DVT) models and their associated tests were deleted. A DVT unit then 
was used satisfactorily in the LM test article 8 (LTA-8) thermal vacuum test-vehicle 
program, thus reducing schedule difficulties and costs for the overall CWEA program. 
Changes to the CWEA, resulting from LM-system-design modifications, were made 
with no impact upon final LM -delivery dates. 

A thorough qualification test program was an integral part of the total CWEA pro- 
gram; design, fabrication, and test preparation were accomplished concurrently with 
CWEA assembly. One manual test station and two automatic test stations were manu- 
factured by the vendor and successfully used for the qualification tests, which were 
successful also. 
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The manufacture of the CWEA was completed with the occurrence of only one se- 
rious problem. Improper setup of a thermal curing chamber caused an entire assembly 
to be overstressed and scrapped. A reallocation of assembled units prevented the loss 
of the unit from affecting LM delivery. 

Throughout the test program and whenever problems occurred, NASA engineers 
traveled to the LM contractor and vendor facilities to monitor tests and to implement 
solutions to these problems. The greatest NASA input to the CWEA program occurred 
when CWEA integration into the LM indicated numerous unforeseen system difficulties. 
Most of the difficulty arose from lack of system planning earlier in the total LM pro- 
gram and a lack of communication between the subsystem managers and the caution and 
warning system managers. A series of weekly (and, later, monthly) meetings was in- 
stituted at the LM contractor facility at the request of NASA to work out immediate so- 
lutions to the system difficulties. A representative from the NASA Manned Spacecraft 
Center (MSC) participated in these meetings, and the system problems were solved. 

The CWEA performed in an outstanding manner on the lunar missions, and a pro- 
gram was set up by NASA to analyze all recorded master alarms for system problems 
before, during, and after the lunar mission. As a result of this program, information 
was compiled in semitechnical language and drawings on all known caution and warning 
alarms caused by interface idiosyncrasies. Additions and deletions were incorporated 
in later revisions as engineering changes were implemented and as analyses of test and 
mission data revealed additional system incompatibilities. This information is con- 
tained in the appendix of this paper. Because of the lack of latching CWEA circuitry, 
some difficulty was encountered in identifying the channel that initiated a master alarm. 
A more suitable CWEA design would have included latching/resettable CWEA inputs on 
every channel rather than on one -third of the channels. Also, the level detectors would 
preferably have been field adjustable. Several CWEA functions had to be deleted be- 
cause of measurement-range changes that caused the CWEA to trip at unwanted levels. 

The success of the CWEA program resulted from a continued dialogue that in- 
cluded representatives of NASA; representatives of the LM contractor; and vendor de- 
sign, test, and systems engineers. Such communication ensured quick identification 
and satisfactory resolution of problems through a coordinated Government-industry 
operation that typified the entire Apollo Program. 


Data Storage Electronics Assembly 

The DSEA is a single -speed magnetic tape recorder that stores voice and mission 
elapsed time (fig. 17). A maximum recording time of 10 hours is provided by driving 
the tape in one direction, reversing direction, and switching to the next track when 
the end of the tape has been reached. Four tracks can be recorded, with a total of 
2-1/2 hours of data recorded on each track. The DSEA has only the recording function, 
and the tape must be played at a specially built ground station. 

A specially designed 400-hertz, single -phase, hysteresis, synchronous motor was 
used to provide constant, steady (±0. 1 percent of input power frequency) tape motion at 
the low speed of 0. 6 in/sec. The voice-frequency recording capability is limited to 
300 to 3000 hertz, and the timing signals are recorded as a 4625 -hertz signal for a 


& 
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Figure 1 7. - Functional block diagram of DSEA. 


"zero" and as a 4175-hertz signal for a "one." In addition, a 5200-hertz signal is re- 
corded as a reference to reduce flutter during tape playback. Steady tape movement 
(provided by the motor) and sharp filtering are required for effective recording and 
playback. 

A tape cartridge is used because it is the most efficient way to handle the tape 
each time it is removed for playback and replacement. Negator springs are used in the 
cartridge to assist the drive motors and to maintain the proper tension on the tape. A 
pair of negator springs is installed on each of the coaxial reels of the cartridge; these 
springs apply a force that tends to wind the tape onto the reel. The motor -drive cap- 
stans pull the tape from one reel and wind up the pair of negator springs for that reel 
while the negator springs for the other reel wind the tape onto that reel. 

During developmental testing, it was very difficult to keep the flutter (tape -speed 
variations) within the specification of 3 percent during vibration. Extensive tests and 
studies revealed that the problem existed because the cartridge contact in the head and 
capstan area of the transport was too firm, causing the vibration of the reels to be fed 
to the recording area and increasing the flutter. The cartridge and the tiedown system 
were modified slightly to alleviate this problem. 
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After the qualification tests had been completed, the vibration levels were raised 
because of a program at MSC to identify weak components. During the requalification 
testing at the higher vibration levels, the flutter again exceeded specification to approx- 
imately 5 percent. This high flutter could not be corrected without an extensive rede- 
sign. Most of the units had already been built, and the cost of modifying them would 
have been prohibitive. It was decided to waive the flutter requirement because the units 
performed properly with no signs of damage after the vibration, because the vibration 
levels were higher than flight vibration levels, and because voice reproduction was sat- 
isfactory at the higher flutter level. Only the timing data are lost at the higher flutter, 
and the highest vibration during a mission occurs during descent or ascent. The re- 
corder runs continuously shortly before and during descent or ascent; therefore, the 
time from the last good timing signal received is easily determined if the timing drops 
out. In fact, no significant timing losses have occurred during the LM flights. 

Another design problem was presented by lubricant leaking from the bearings in 
the tape cartridge. A small amount of lubricant was used in the small bearings; how- 
ever, during long idle periods (2 to 3 months), the lubricant drained out, creating the 
possibility of slippage between the tape and capstan and fouling of the recording heads. 
Extensive testing showed that very little or no lubricant was required in the cartridge. 
This problem was solved by initiating a new lubrication specification that required only 
a very small amount of lubricant and by operating the units for 30 minutes every 
120 days. 

During flights, the only problem experienced was the breaking of vehicle wires 
leading to the DSEA. The small 26 -gage signal wires broke on three vehicles and 
caused the loss of all data from the Apollo 11 DSEA. Also, during normal insertion 
of the cartridge, the tape was damaged. The cartridge had to be inserted at an angle 
so that the upper edge of the tape contacted the capstans first. It took the full force re- 
quired to unwind enough tape from the reels to make good contact with the capstans. 

This force caused the upper edges at the beginning of the tape to become wrinkled and 
cupped after several loadings. The use of a loading tool, which was developed to allow 
straight insertion of the cartridge, prevented the damage. 

Any future voice recorders should use an easily insertable cartridge and a voice - 
operated-relay (VOX) circuit in the recorder. During the lunar missions, the crew 
does not use the VOX mode because of voice clipping, but keeps the intercom and DSEA 
on continuously. This procedure results in the DSEA running out of tape before the end 
of the mission. A VOX circuit in the DSEA, independent of the audio center, would have 
allowed a much more efficient use of tape. In addition, the time required for the re- 
corder to be operating is becoming longer with each mission. Because the cartridge 
cannot be easily replaced during flight, the only way in which these new requirements 
can be met is by adding another DSEA or a VOX circuit between the DSEA and the audio 
center. 


Transducers 

The LM instrumentation transducers sense physical data such as temperature, 
valve and switch positions, pressure, and water and propellant quantities. The trans- 
ducers then convert this physical data to electrical signals that are compatible with the 
SCEA, PCMTEA, and CWEA and with the panel meters. All but one of the transducers 
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employ integral signal conditioning that produces the standard 0- to 5 -volt dc output. 

The temperature -transducer outputs are routed to the SCEA where they are converted 
to the standard 0- to 5 -volt dc signal. All the transducers that use integral signal con- 
ditioning (except temperature transducers, which require no power) receive power 
through the signal -sensor circuit breaker and through individual fuses in the fuse sensor 
assembly. 

The transducer designs were selected on the basis of accuracy, power consump- 
tion, size, weight, reliability, developmental time and cost, multirange capability, 
mounting requirements, background of the device, and possible effects on the system 
to be monitored. Most of the transducers were developed by modifying commercial 
equipment; however, these modified transducers caused most of the instrumentation 
problems. Units that could pass qualification tests could be produced, but the units 
were not reliable if they were produced in quantity. The only transducer that has been 
trouble-free is the resistance -thermometer type used to measure temperatures. 

The switches used to detect LM landing -gear deployment and to turn on the track- 
ing lights and floodlights are modified versions of commercial hardware. Normally, 
these pushbutton devices are made of stainless steel. However, the LM versions are 
the only aluminum switches qualified for the space environment. To save weight, alu- 
minum was used for everything in the switches except the springs and contacts. This 
use of aluminum created special design considerations, such as finding an epoxy that 
has the same thermal expansion characteristics as aluminum within a temperature 
range of -260° to +260° F. Another problem that developed during vacuum -chamber 
tests was that the contacting aluminum parts would cold -weld together. All the parts 
that had to move freely were plated with a dry film lubricant to prevent any sticking. 

The only vehicle problem concerned a manufacturing deficiency in one lot. The collar 
on the plunger was badly crimped; however, this defect was easily detected by X-ray 
and was isolated to one lot. 

Two types of pressure transducers were developed to provide two sources for 
hardware. The designs of these transducers are entirely different, and different prob- 
lems have occurred. The transducers are mechanically and electrically interchange- 
able and have identical pressure ranges. Both transducers are designed so that the 
outer case serves as a leak -proof chamber that can withstand the monitored pressure 
if the sensing element leaks or ruptures. 

One type of transducer consisted of a sensor with a semiconductor strain-gage 
network mounted on a diaphragm and of an electronics package built with discrete parts. 
The electronics components have performed very well, but the sensor has been prone to 
erratic, unpredictable shifts caused by the strain gages. Screening techniques during 
and after delivery isolated the defective shifters, but no method has been found to pro- 
duce a highly reliable pressure transducer of this type. A similar problem occurred 
with the water quantity measuring device (WQMD); this problem is discussed in a later 
section of this report. 

Another problem occurred with the high -temperature version of the first type of 
transducer. This problem involved a very low manufacturing yield of acceptable trans- 
ducers. By offsetting the center of the diaphragm and increasing the size of the fillet 
(the portion of the diaphragm that connects to the transducer barrel), the yield of good 
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transducers rose to an acceptable level; however, a new problem occurred. The new 
feed-through header required for the diaphragm change was subject to damage during 
manufacturing. This damage resulted in slow leaks. A stringent, 24 -hour, overpres- 
sure leak test was incorporated to identify the leaky transducers. 

The other type of pressure transducer had a twisted Bourdon tube with a variable - 
reluctance position sensor and a hybrid thin-film electronics package. The sensing 
element has been extremely stable, but the electronics package caused much trouble. 
Eventually, the electronics package was redesigned using discrete components, a 
method that produced good results in the first transducer electronics package. With 
the new electronics package, this transducer has worked quite well. Few pressure 
transducers of either design have failed during flight. 

The WQMD caused more problems than any other item in the instrumentation sub- 
system. The WQMD is a temperature -compensated pressure transducer that produces 
an extremely nonlinear output. This transducer consists of a strain-gage network and 
a resistance thermometer (for temperature compensation) mounted on a diaphragm. 

The electronics portion takes the strain-gage resistances and produces a linear quantity 
output; this output is nonlinear in regard to the pressure. The pressure drop for a unit 
of water usage is much greater for a nearly full- water tank than for a nearly empty 
water tank. This pressure drop forces the electronics unit to produce a nonlinear out- 
put with regard to the pressure remaining. Also, the WQMD can be adjusted to produce 
a 100-percent-full reading for a water-tank loading of from 45 percent to 75 percent full. 
In this case, the electronics unit compensates for the differently shaped curves of 
amount of water remaining compared with pressure for any of these loadings . The 
more fully loaded tanks produced the most bowed curves. Originally, the WQMD was 
designed for only a 75-percent-full loading. Later, it was modified to accept a smaller 
loading. The WQMD always has been plagued with shift problems related to the strain 
gages. The strain gages would shift or become nonohmic (shorted) for no apparent 
reason. Extensive studies revealed that contaminants in the silicon dioxide coating 
caused the strain gages to become nonohmic. The time required for the occurrence of 
this condition varied with (1) the amount of voltage and the amount of time it was applied, 
(2) the amount of contaminants, and (3) the temperature. Nothing was found to eliminate 
the problem. No screen test was reliable, and the problem could not be solved easily. 
Thus, the WQMD was replaced with the Bourdon tube-type pressure transducer on 
LM-9 and later vehicles. The conversion from pressure to amount of water remaining 
is accomplished by ground personnel. 

Before the launch of LM-4, one of the installed water quantity measuring devices 
failed. Investigation showed that iodine in the water tanks had corroded through the 
WQMD diaphragm. It was the only WQMD to show signs of this type of corrosion. 

Tests were indicative that the iodine would attack the inclusions (impurities) in the dia- 
phragm. The diaphragm and body of the WQMD are milled from a single piece of 
Ni Span-C alloy (nickel base). The grain of the metal is perpendicular to the surface 
of the diaphragm. With the grain alined in this manner, needle-shaped impurities also 
are alined perpendicular to the diaphragm. If these impurities are long enough, the dia- 
phragm is penetrated. Usually, these impurities are not long enough to cause penetra- 
tion. Several methods to correct the problem were considered: (1) building the 
diaphragm out of a different material, (2) building new diaphragms out of Ni Span-C 
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with the grain alined parallel to the surface so that inclusions would not penetrate the 
diaphragm, or (3) finding a protective coating for the diaphragm. This last method was 
chosen because it had the least cost and time impact. Gold, silver, and platinum 
platings were ineffective; and, eventually, an epoxy was chosen that worked well. 

This epoxy coating, however, caused another problem. The epoxy absorbed a 
small amount of water and swelled slightly. This swelling depressed the diaphragm, 
causing a positive shift of 3 to 5 percent in the output. This shift was minimized by 
making the epoxy coating as thin and as uniform as possible. Tests were run to deter- 
mine the amount of shift, then repeated to determine the repeatability. Acceptance of 
a uni t was based on a repeatability of not more than 1 percent of the original reading. 
The amount of shift caused by the epoxy absorbing water was used to bias the error out 
of the flight data. 

Although numerous failures occurred during testing and the WQMD was replaced 
eventually with absolute pressure transducers, only one of the 15 water quantity meas- 
uring devices drifted out of specification during a mission. 

The propellant quantity measuring device (PQMD) used to monitor the RCS fuel 
level was essentially the same device as the WQMD. The PQMD was designed to meas- 
ure higher pressures than the WQMD, and the PQMD has a much smaller diaphragm. 
This smaller diaphragm is an installation requirement. In contrast to the WQMD, very 
few problems and failures were experienced with the PQMD; the failures were only 1 to 
2 percent out of tolerance. The only explanation so far presented is that the PQMD is 
not as sensitive to shift because it operates at higher pressures. The history of these 
two devices, both manufactured by the same vendor, makes it apparent that a great 
deal is yet to be discovered about semiconductor strain -gage technology. 


CONCLUSIONS AND RECOMMENDATIONS 


Although many failures and problems occurred during development and vehicle 
integration tests, the lunar module instrumentation subsystem performed well during 
missions. This performance has been accomplished by testing to determine the cause 
of the problems, then developing a cure for the problems or a screening test to elimi- 
nate the problem items. From the experience gained from vehicle integration tests, it 
is obvious that all components of the instrumentation subsystem must be as versatile 
as possible to accept changing interfaces and the eccentricities of those interfaces. 

The following recommendations are made for signal conditioning. 

1. Use plug-in modules to the lowest subassembly practical in order to have the 
smallest impact in case of failure. 

2. Make all range changes easily accessible. 

3. Make all module locations (including spares) on the chassis capable of accept- 
ing any type of subassembly. 


18 


4. Make the discrete signal conditioners trip at as low a resistance as possible 
to prevent high resistance (120 000 ohms or less) from causing false indication. 

5. Have ground-support -equipment connectors for testing and monitoring all in- 
puts and outputs. 

The following recommendations are made for the caution and warning system. 

1. Make all functions latching and resettable. 

2. Make all analog level detectors easily adjustable and capable of being inhibited 
or enabled. 

3. Have a number of spare discrete and analog detectors available for any new 
requirements. These spare detectors should be capable of being easily connected 
(either by jumper wires at the connectors or by easily manufactured plug-in jumper 
modules) to create the desired circuit. 

4. Have inhibit and enable signals for major events (such as ascent/descent 
staging) that can be routed to any of the circuits. 

The following recommendations are made for voice recording. 

1. Use cartridges that do not require any special skill for installation and re- 
placement and that protect the tape as much as possible during storage and handling. 

2. Have a built-in voice -operated circuit provided with an external override. 

The following recommendations are made for transducers. 

1. Have adjustments available to compensate for small (less than 10 percent) 
long-term drifts. 

2. Thoroughly investigate materials used for compatibility to their environment 
and potential environment. This investigation would include cold -welding in a vacuum, 
thermal expansion, and corrosive and oxygen exposure. 

3. Ensure that all transducers used in fluid lines and tanks contain secondary 
pressure seals. In the case of pressure transducers, these can be provided by the 
reference chamber seals. 


Manned Spacecraft Center 

National Aeronautics and Space Administration 
Houston, Texas, October 29, 1971 
914 -50 -DJ -96 -72 
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APPENDIX 
LUNAR MODULE 

CAUTION AND WARNING SYSTEM 
CHARACTERISTICS AND NUISANCE ALARMS 

INTRODUCTION 


For reference purposes and for aid in locating specific caution and warning cir- 
cuits, pertinent information is listed in the following table. 


Measurement 
code number 

Indicator 

number 

Nomenclature 

Page 

GL4022 

6DS2 

Ascent low-pressure warning 

21 

GL4023 

6DS3 

Helium pressure regulator outlet manifold 
warning 

22 

GL4026 

6DS6 

Control electronics section ac power -supply 
failure warning 

24 

GL4027 

6DS7 

Control electronics section dc power -supply 
failure warning 

24 

GL4028 

6DS8 

Abort guidance section power -supply failure 
warning 

26 

GL4029 

6DS9 

Primary guidance and navigation section LM 
guidance computer warning 

29 

GL4031 

6DS11 

Reaction control subsystem thrust chamber 
assembly jet-failure warning 

30 

GL4032 

6DS12 

Reaction control subsystem helium regulator 
outlet pressure warning (system A) 

32 

GL4033 

6DS13 

Reaction control subsystem helium regulator 
outlet pressure warning (system B) 

32 

GL4037 

6DS17 

Suit/fan warning 

33 

GL4046 

6DS26 

Electrical power subsystem inverter caution 

36 
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Measurement 
code number 

Indicator 

number 

Nomenclature 

Page 

GL4048 

6DS28 

Rendezvous radar data -no -good caution 

37 

GL4049 

6DS29 

Landing radar data -no -good caution 

39 

GL4051 

6DS31 

Explosive devices malfunction caution 

40 

GL4053 

6DS33 

Heater caution (RCS quad-cluster 
temperatures) 

42 

GL4053 

6DS33 

Heater caution (landing radar antenna 
temperatures) 

42 

GL4056 

6DS36 

Environmental control subsystem caution 

45 

GL4060 

6DS40 

S-band receiver (automatic gain control 
alarm) caution 

45 

GL4024 

6DS4 

Low descent propellant quantity warning 

46 


ASCENT LOW-PRESSURE WARNING 
Characteristic 

Ascent low-pressure warning is ON when the CWEA is first activated and remains 
ON until ascent pressurization. 


Discussion 

The ascent propellant tanks are loaded to capacity for a "G" (lunar landing) mis- 
sion with a resulting small ullage volume. Prior to launch, a blanket pressure of he- 
lium (approximately 180 psia) is applied to the propellant tanks. However, because of 
the relatively small volume of helium, absorption of helium by the propellants causes 
this blanket pressure to decay below the CWEA trip level of 120 psia. As a result of 
this absorption, low inlet pressures (<120 psia) at the engine isolation valves are ex- 
pected during the LM-5 mission, at initial CWEA turn-on (ground elapsed time 94:37). 
This condition will cause initiation (at CWEA activation) of an ascent pressure warning 
that cannot be removed prior to ascent pressurization. 


I mpact on LM-5 

The ascent pressure failure -detection circuit (fig. 18) consists of four separate 
parameters in OR -gate configuration. An out-of -tolerance condition existing at any one 
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115-Vac bus 



Figure 18. - Ascent pressure failure -detection circuit. 


of the four input parameters activates the warning light. Once the light is activated, 
subsequent failures at the other inputs cannot be detected. Because an out -of -tolerance 
condition is expected as a result of low isolation -valve inlet pressure (GP1501 and 
GP1503), an ascent helium leak (GP0001 or GP0002) cannot be detected by the CWEA. 
Helium tank pressures are available to the crew by means of onboard digital display 
and to the MSFN by means of telemetry. 


HELIUM PRESSURE REGULATOR OUTLET MANIFOLD WARNING 

Characteristic 1 

Venting of descent helium will cause a descent helium regulator warning indica- 
tion and a master alarm. 

Discussion. - The fuel vent (GQ3500X) and the oxidizer vent (GQ4000X) are used to 
vent the descent helium shortly after lunar landing. The helium regulator outlet pres- 
sure (GQ3018P) will fall below the CWEA trip level of 219. 2 psia and activate warning 
light GL4023 (fig. 19) and the master alarm. 
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Figure 19. - Helium pressure regulator manifold failure -detection circuit. 


Corrective action. - The master alarm should be reset. The warning light will be 
extinguished automatically at staging. However, it can be extinguished before staging 
by cycling the CWEA circuit breaker following removal of descent engine arm. 


Characteristic 2 

A false descent helium regulator warning occurs with the descent engine control 
assembly (DECA) circuit breaker open. 

Discussion. - Characteristic 2 is caused by a gradual decrease of insulation re- 
sistance in the DECA Jennings relay after repeated operations. When the DECA cir- 
cuit breaker is closed, +28 volts is fed to the SCEA input, biasing the SCEA to an off 
position. This bias voltage effectively reduces the sensitivity of the SCEA input, making 
the SCEA insensitive to the open -contact resistance of the Jennings relay. However, 
when this bias voltage is not present (DECA circuit breaker open), the sensitivity of the 
SCEA increases to a point at which the open-contact resistance of the Jennings relay 
appears to the SCEA as a closed contact. This condition is recognized by the CWEA as 
a descent engine arm signal from the DECA with no helium pressure in the manifold, 
and the master alarm is activated. 
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Corrective action for LM-3 and LM-4 . - No hardware change will be implemented. 
During vehicle ground checkout, a false descent regulator alarm may occur any time the 
DECA circuit breaker is open. This occurrence should be expected on these vehicles. 

For flight operation, a procedural change to close the DECA power circuit breaker 
before the CWEA circuit breaker is closed has been incorporated in the Apollo Opera- 
tions Handbook (AOH). 

Corrective action for LM-5 and subsequent vehicles. - A biasing resistor is in- 
stalled between the SCEA-1 circuit breaker and the power lead to the DECA. This re - 
sistor applies a bias voltage to the SCEA input whenever the CWEA breaker is closed 
and is independent of the position of the DECA circuit breaker. 


CONTROL ELECTRONICS SECTION ac AND dc 
POWER-SUPPLY FAILURE WARNINGS 

Characteristic 

This condition is characterized by a loss of failure -detection capability during the 
power-up sequence. 


Discussion 

Each control electronics section (CES) power-supply output is monitored by an 
individual level detector in the CWEA (figs. 20 and 21). Each level detector is designed 
to produce a logic zero at its output if the power supply being monitored is delivering 
a voltage within predetermined levels. If the power supply exceeds these levels (either 
above or below), a logic one is produced at the output of the level detector. The out- 
puts of each group (ac or dc) of level detectors are OR -gated and fed to their respective 
flip-flops. When all power supplies are in limits, a logic zero from the output of each 
level detector is applied to the flip-flop. The flip-flop is in the reset state with a logic 
zero at its output. If any power supply goes out of limits, a logic one is transferred 
to the input of the flip-flop. This transition from a logic zero to a logic one at the 
input to the flip-flop is required to set the flip-flop, activate the master alarm, and 
illuminate the annunciator light. 

During LM missions, the CWEA is turned on prior to activation of the CES power 
supplies. As a result, the level detectors in the CWEA sense zero voltages at their 
respective inputs and produce logic ones at their outputs. The flip-flop is set, the 
annunciator lights are turned on, and the master alarm is activated. The annunciator 
lights can be extinguished by resetting the flip-flop by means of the rate gyro assembly 
gyro test switch. This action, however, does not remove the logic one at the input 
to the flip-flop. 
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Figure 20. - Control electronics section dc power -supply failure -detection circuit. 


When the CES power supplies are subsequently turned on by means of the ATCA 
circuit breaker, two possibilities exist. 

1. All power supplies operate normally and are in limits. In this case, the logic 
one at the input to the flip-flop is removed, and the failure- detection circuits are 

able to recognize a subsequent power-supply failure. 

2. One or more of the power supplies fails to come within limits. In this case, 
the logic one remains at the input to the flip-flop, and the failure- detection circuits 
are unable to detect the failure. 
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Figure 21. - Control electronics section ac power -supply failure -detection circuit. 



Input SCEA 


Corrective Action for LM-3 and Subsequent Vehicles 

A procedural change to the AOH power-up sequence provides for recycling the 
CWEA circuit breaker after closing the ATCA circuit breaker. This procedure will 
ensure that the previous CES power-supply failure indications (caused by an open ATCA 
circuit breaker) registered in the CWEA circuits are erased, that the flip-flops are re- 
set, and that the annunciator lights are extinguished. The CWEA will be fully enabled 
to detect any existing or subsequent failures. This same procedure also should be used 
during ground checkout to ensure that a failed CES power supply will not go undetected. 


ABORT GUIDANCE SECTION POWER-SUPPLY FAILURE WARNING 

Characteristic 1 

A master alarm occurs when the abort guidance section (AGS) status switch is 
placed in the standby or operate position. 
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Discussion. - The CWEA abort guidance circuit (fig. 22) monitors four separate 
AGS parameters. Three of these are power -supply parameters located in the abort 
sensor assembly (ASA). The fourth parameter being monitored is the abort electronics 
assembly (AEA) test mode fail (TMF). All four parameters are OR-gated and fed to a 
dual -input AND -gate, which is inhibited when the AGS status switch is in the off position. 



Note: P/S ■ power supply 


Figure 22. - Abort guidance section power -supply failure -detection circuit. 


Abort guidance section power up: A master alarm occurs when the AGS status 
switch is moved from the off position to the standby position. In this case, the CWEA 
inhibit is removed and the ASA power supplies are turned on. The AGS warning light 
will stay on until the AEA circuit breaker is closed and all ASA power supplies reach a 
stabilized, in-limits condition, removing the failed indication from the CWEA input. 
The 400-hertz ASA power supply is derived from a 128-kpps clock pulse provided by 
the AEA; therefore, the AEA circuit breaker must be closed to extinguish the AGS 
warning light in the standby position. 

A master alarm occurs when the AGS status switch is moved from the standby 
position to the operate position. In this case, the AEA operational power supplies are 
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turned on and the hardwired memory cores are primed in the AEA memory. This ac- 
tion sets the TMF flip-flop, indicating a failure for approximately 200 milliseconds un- 
til the core priming is complete. 

Abort guidance section power down: A master alarm occurs when the AGS status 
switch is moved from the operate position to the standby position to the off position. 

The AOH power-down procedures place the stabilization and control (S&C): AEA 
circuit breaker in the open position, prior to moving the AGS status switch out of the 
operate position. An AGS warning will result from loss of the AEA 128-kpps clock 
pulse to the 400 -hertz ASA power supply. The AGS warning light will remain on until 
the AGS status switch is placed in the off position. 

Corrective action fo r LM-^and LM-4. - Characteristic 1 is noted in the AOH as 
an expected alarm during operation of the AGS status switch. The crew will acknowl- 
edge and reset the master alarm as part of the procedure. 

Corrective action for LM-5 and subsequent vehicles. - Because of a design change 
in the CWEA (addition of a flip-flop to AEA TMF logic), an additional AOH procedure is 
required for LM-5 and subsequent vehicles. When the AGS status switch is placed in 
the operate position, an AEA TMF is generated and the flip-flop is set. The crew must 
(1) reset the flip-flop by manually placing the environmental control subsystem (ECS) 
Og/HgO quantity monitor switch in the CWEA reset position (to extinguish the AGS warn 

ing light) and (2) use the data entry and display assembly (DEDA) to verify the status of 
the AEA. 


Characteristic 2 

A master alarm occurs during operation of the AGS with no accompanying AGS 
annunciator light. 

Discussion . - Characteristic 2 is caused by a short -duration loss of memory in 
the AEA, resulting in an AEA restart. The failure is detected by the CWEA, and a 
master alarm is generated. The AGS annunciator light will be illuminated while the 
failure exists and will be extinguished automatically when the failure is removed. If 
the failure is of short duration (on the order of milliseconds), the annunciator light 
will only blink on and off and can go undetected. 

Corrective action for LM-3 and LM-4. - The AOH will be revised to note the pos- 
sible occurrence of an AEA restart, initiating a master alarm with no CWEA annuncia- 
tor light. The AOH procedure will direct the crew to use the DEDA to verify AEA 
status. 

Corrective action for LM-5 and subsequent vehicles. - A flip-flop was added to the 
AEA TMF logic to preclude the possibility of an undetected AEA restart. With the in- 
corporation of this change to the CWEA, all AEA failures will set the flip-flop, initiate 
a master alarm, and illuminate the AGS warning annunciator light. The annunciator 
light will remain on until manually reset by placing the ECS Og/HgO quantity monitor 
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switch in the CWEA reset position. Resetting the flip-flop will extinguish the AGS warn- 
ing light and enable the CWEA to monitor subsequent failures. The ability to extinguish 
the AGS warning light with the reset verifies that the failure occurred in the AEA. The 
current status of the AEA then must be verified by using the DEDA. If the AGS warning 
light is activated by an ASA power-supply failure, it cannot be extinguished by using the 
reset capability. 


PRIMARY GUIDANCE AND NAVIGATION SECTION 
LM GU I DANCE COMPUTER WARN I NG 

Characteristic 

A false master alarm may be generated with activation of the LM guidance com- 
puter (LGC) /display and keyboard (DSKY) circuit breaker subsequent to turn-on of the 
CWEA circuit breaker (fig. 23). 



Figure 23. - Lunar module guidance computer failure -detection circuit. 
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Discussion 


If the CWEA circuit breaker is closed and the LGC/DSKY circuit breaker is open, 
the LGC fail relay will be in the deenergized state and the CWEA will initiate a master 
alarm. Subsequent closure of the LGC/DSKY circuit breaker will produce one of the 
following conditions. 

1. In the majority of cases, the warning light will be extinguished immediately 
because the LGC fail relay will be energized immediately, and a master alarm will not 
be generated. 

2. In some cases, as a result of LGC variables, it is possible that the LGC fail 
relay will be interrupted momentarily, causing a false master alarm to be displayed 
for as long as 20 seconds. 


Corrective Action for LM-3 and Subsequent Vehicles 

A procedural note is included in the AOH to indicate that an alarm, with accom- 
panying LGC warning light illuminated for as long as 20 seconds, should be expected 
when the LGC/DSKY circuit breaker is closed. 


REACTION CONTROL SUBSYSTEM THRUST CHAMBER 
ASSEMBLY JET-FAILURE WARNING 


Characteristic 

False jet -failure indications occur with thrust chamber assembly (TCA) quad 
circuit breakers open. 


Discussion 

Extremely long wire -runs from the TCA quad circuit breakers, to the jet-driver 
solenoids on the quad clusters, back to the ATCA, and, finally, to the SCEA are the 
cause of this condition. When the quad circuit breakers are closed, +28 volts is fed to 
the SCEA inputs, effectively biasing the SCEA to an off condition (fig. 24). When the 
quad circuit breakers are open, these long -lead lengths at the input to the SCEA act as 
antennas and are susceptible to noise pickups. Because no biasing voltage is present 
at the SCEA input, the noise appears to the SCEA as jet-driver commands. These false 
jet -driver commands can indicate a failed -TCA -jet condition and activate the master 
alarm by either of two paths: 

1. By means of the counters in the CWEA logic when seven consecutive commands 
are received without an accompanying thruster response 

2. By means of the opposing jet logic in the CWEA when commands are sent si- 
multaneously to opposing jets 
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Corrective Action for LM-3 and LM-4 

No hardware change will be implemented. During vehicle ground checkout, any 
indication of jet failures with the TCA quad breakers open should not be considered a 
problem worthy of any further investigation. For flight operation, a procedural work- 
around has been included in the AOH to preclude an erroneous jet -failure indication dur- 
ing the periods of the mission when the ECS is powered down for an extravehicular 
activity (EVA) period. The procedural workaround is as follows. Prior to EVA, all 
quad circuit breakers are open and all (eight) counters in the CWEA logic are loaded 
by operation of the thrust/translation controller assembly to induce a failure in all 
quads. The master alarm is reset, and no possibility of an erroneous jet -failure alarm 
exists during the EVA period. At the conclusion of EVA, the CWEA circuit breaker is 
cycled (off/on) to enable the CWEA to detect subsequent failures. 


Corrective Action for LM-5 and Subsequent Vehicles 

Biasing resistors are installed between the SCEA-1 and CWEA circuit breakers 
and the jet-driver solenoid lines. These resistors effectively apply a bias voltage to 
the SCEA input whenever the SCEA and CWEA circuit breakers are closed and are in- 
dependent of the position of the quad-cluster circuit breakers. 
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REACTION CONTROL SUBSYSTEM HELIUM REGULATOR 
OUTLET PRESSURE WARNING 

Characteristic 

The RCS helium regulator warning lights come on prior to pressurization (fig. 25). 


Main fuel 
feed - sys A 
(GR2461I 

,L 

i 

i 

Main oxid 
feed - sys A 
(GR3461) 


Pressure 
reg A 
output 
(GR1201P) 


Pressure 
reg B 
output 
(GR1202P) 


Main fuel 
feed - sys B 
(GR2462) 
l 
I 

8S9 

I 

I 

Main oxid 
feed - sys B 
(GR3462I 



(GR9610U) 


8FL5 

PCM 

PCM 

8M1 


GL4032 

(W) 


GL4033 

(W) 


8FL7 

PCM 


Figure 25. - Reaction control subsystem helium pressure regulator 

failure -detection circuit. 


Discussion 

Current RCS procedure calls for the main propellant valves of RCS systems A 
and B to be opened before launch. By placing these valves in the open position, the RCS 
helium regulator warning circuits in the CWEA are enabled. This procedure will cause 
both RCS helium regulator warning lights to come on when the CWEA circuit breaker is 
first closed. Both lights will remain on until the RCS system is pressurized. 
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Corrective Action for LM-3 and Subsequent Vehicles 

No hardware change will be implemented. A note alerting the crew to this charac- 
teristic will be added to the AOH procedure. 


SUIT/FAN WARNING 


Characteristic 

Switching from suit fan 1 to suit fan 2 (under a condition of low differential pres- 
sure with fan condition signal-control relay K12 energized) may cause two successive 
suit/fan warnings (fig. 26). 



Figure 26. - Environmental control subsystem suit outlet pressure 

failure -detection circuit. 
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Discussion 

The first warning occurs because of the time required for suit fan 2 to build up 
enough pressure to open the differential pressure switch; that is, relay K12 is still en- 
ergized at the instant of switching. The crew then resets the master alarm. The sec- 
ond warning would occur approximately 5 to 10 seconds after relay K12 opens and is 
dependent on the specific characteristics of the individual SCEA module and the CWEA 
detector. Because of a 25 -microfarad capacitance across the contacts of relay K12, 
the SCEA input voltage rises exponentially rather than discretely. This characteristic, 
combined with the internal feedback characteristics of the 504-3 SCEA buffer, produces 
a short period of output voltage oscillation. If this oscillation occurs after the CWEA 
has reset, the second master alarm may occur. Note that the component warning light 
will be extinguished. Additional characteristics of this circuit are included in table I. 


TABLE I. - CHARACTERISTICS OF SUIT FAN CAUTION (GL4056) AND WARNING (GL4037) CIRCUITS 





Display characteristics and conditions 


Position and cycling of 
suit fan select 

ECS component light 


6DS17 

suit fan warning lignl 


switch 7S1 

7DS1 
suit fan 

7DS7 

HgO separator 

ECS caution light 

Master alarm 

Off 

On 

If suit fan 
differential 
pressure (AP) 
circuit breaker 
is closed 

On 

No driving power, 
both suit fans 
ofl 

On 

Caused by H 2 0 separator 

impeller speed 
<"800 rpm 

Off 

Yes 

Caused by H 2 0 separator 
impeller speed 
<800 i pm 

Off to suit fan 1 

On 

Goes out when 
suit fan AP 
is established 
and relay K12 
is deenergized 

On 

Goes out when H^O 

separator impel- 
ler speed exceeds 
800 rpm 

On 

Goes out when HgO 

separator impel- 
ler speed exceeds 
800 rpm 

Off 

Stays off 

Does not monitor fan 1 
operat-on 

No 

Has been reset prior lo 
selection of suit fan 1, 
caused bv HgO separator 
impeller speed <800 rpm 

Suit fan 1 to off 

Off 

Goes on when 
loss of AP 
energizes 
relay K12 

Off 

Goes on when impel- 
ler speed drops 
below 800 rpm 

Off 

Goes on when impeller 
speed drops below 
800 rpm 

Off 

Stays off 

Yes 

When impeller speed drops 
below 800 rpm 

Off to suit fan 2 
(passing quickly 
through suit fan 1 
position) 

On 

Goes out when 
suit fan AP 
is established 
and relay K12 
is deenergized 

On 

Goes out when H^O 

separator impel- 
ler speed exceeds 
800 rpm 

On 

Goes out when H^O 

separator impel- 
ler speed exceeds 
800 rpm 

Off 

Goes out when suit fan 2 
is selected 

Goes out when AP is estab- 
lished and relay K12 is 
deenergized 

May blink on again approxi- 
mately 5 to 10 sec later 
from action of capacitor 
across relay K12 contacts 

Yes 

When fan 2 is selected be- 
cause relay K12 is 
already energized by 
absence of AP 
If master alarm is reset 
immediately, the alarm 
may be generated again 
from action of the ca- 
pacitor across the con- 
tacts of relay K12 

Suit fan 2 to off 
(passing quickly 
through suit fan 1 
position) when suit 
fan 2 did not fail 

Off 

Goes on when 
loss of AP 
energizes 
relay K12 

Off 

Goes on when 
impeller speed 
drops below 
800 rpm 

Off 

Goes on when impeller 
speed drops below 
800 rpm 

Off 

Stays off 

Yes 

When impeller speed 
drops below 800 rpm 

Suit fan 1 to suit 
fan 2 without fan 1 
failure 

Off 

Blinks on and 
off when 
momentary 
loss of AP 
energizes 
relay K12 

Off 

Stays off 

Inertia of impeller 
maintains speed 
>800 rpm during 
switchover 

Off 

Stays off 
Does not monitor 
fan 2 operation 

Off 

Blinks on, then off - when 
suit fan AP drops below 
normal - faster than fan 2 
can restore AP 
May blink on and off a sec- 
ond time, 5 to 10 sec 
after AP is established, 
from action of capacitor 
across relay K12 contacts 

Yes 

Relay K12 is energized by 
drop in AP during 
switchover 

If master alarm is reset 
immediately, the alarm 
may be generated again 
by the capacitor action 
across the contacts of 
relay K12 
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TABLE I. - CHARACTERISTICS OF SUIT FAN CAUTION (GL4056) AND WARNING (GL4037) CIRCUITS - Concluded 


Position and cycling of 
suit fan select 
switch 7S1 


ECS component light 


7DS1 7DS7 

suit fan H^O separator 


Display characteristics and conditions 


6DS36 

ECS caution light 


6DS17 

suit fan warning light 


Suit fan 1 to suit 
fan 2, resulting 
from fan 1 failure 


On 

When drop 
in Ap ener- 
gizes relay K12 
Goes off when 
AP is restored 
and relay K 12 
is deenergized 


Off 

Comes on if impeller 
speed drops below 
800 rpm before 
selection of suit 
fan 2 


On 

When drop in AP ener- 
gizes relay K12 

If HgO separator impeller 

speed does not drop 
below 800 rpm, light 
goes out when fan 2 
is selected 

If impeller speed does 
drop below 800 rpm, 
light will go out when 
impeller speed 
>800 rpm 


Off 

Comes on when suit fan 2 is 
selected 

Goes out when AP is re- 
stored and relay K12 is 
deenergized 

May blink on and off 5 to 
10 sec later from action 
of capacitor across 
relay K12 contacts 


Suit fan 2 to suit 
fan 1, without suit 
fan 2 failure 


Off 

Blinks on and 
off when 
momentary 
loss of AP 
energizes 
relay K12 


Off 

Stays off 

Inertia of impeller 
maintains speed 
>800 rpm during 
switchover 


Off 

Blinks on and off when 
momentary loss of 
AP energizes re- 
lay K12 

May blink on and off a 
second time, 5 to 
10 sec after AP is 
restored, from 
action of capacitor 
across relay K12 
contacts 


Off 

Slays off 

Does not monitor fan 1 
operation 


Suit fan 2 to suit 
fan 1 (suit fan 2 
failure, fan 1 is 
good) 


On 

When drop in AP 
energizes re- 
lay K12 
Goes off when 
AP is restored 
and relay K12 
is deenergized 


Comes on if impeller 
speed drops below 
800 rpm before 
selection of suit 
fan 1 


Comes on when fan 1 is 
selected as a result 
of low AP 

If H 2 O separator impel- 
ler speed does not 
drop below 800 rpm, 
light goes out when 
AP is restored 
Light may blink on and 
off a second time 
5 to 10 sec after AP 
is restored from 
action of capacitor 
across contacts of 
relay K12 

If HgO separator impel- 
ler speed does drop 
below 880 rpm, light 
will go out when im- 
peller speed >800 rpm 
The light may blink on 
and on a second time 
only if impeller speed 
reaches 800 rpm in 
<5 sec after AP is 
established 


On 

Results from drop in AP 
energizing relay K12 
Goes out and stays out when 
suit fan select switch is 
moved from fan 2 position 


Master alarm 


Yes 

When drop in AP ener- 
gizes relay K12 
If master alarm is reset 
prior to selecting suit 
fan 2, a second alarm 
will be generated when’ 
fan 2 is selected 
If alarm is reset imme- 
diately, a third alarm 
may be generated 5 to 
10 sec after the second 
alarm by action of ca- 
pacitor across the con- 
tacts of relay K12 

Yes 

When drop in AP ener- 
gizes relay K12 
If reset immediately, a 
second alarm may be 
generated 5 to 10 sec 
after AP is restored 
by action of capacitor 
across relay K12 
contacts 


Yes 

Results when drop in AP 
energizes relay K12 as 
a result of fan 2 failure 
If master alarm is reset 
prior to selection of 
suit fan 1, a second 
alarm will be generated 
when fan 1 is selected 
as a result of ECS 
caution 

If alarm is reset imme- 
diately, a third alarm 
may be generated 5 to 
10 sec after AP is 
restored by action of 
capacitor across re- 
lay K12 contacts 
This third alarm will not 
occur if the impeller 
speed drops and remains 
below 800 Fpm for more 
than 10 sec after AP is 
restored 


Corrective Action 

No hardware changes were implemented. The crew will be made aware of this 
situation by means of the AOH. 
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ELECTRICAL POWER SUBSYSTEM INVERTER CAUTION 


Characteristic 

An inverter caution occurs when selecting either inverter from the off position 
(fig. 27). 



Figure 27. - Electrical power subsystem inverter voltage and frequency 

failure -detection circuit. 


Cause 

This instrumentation characteristic is strictly one of timing. With the inverter - 
select switch in the off position, no inverter voltage is applied to the SCEA and the 
CWEA. This condition is analogous to a failed inverter to the CWEA detection circuits, 
and a failed signal is applied to the output AND-gate. Actuation of the inverter caution 
is prevented by the inhibit voltage applied through the off position of the inverter -select 
switch to the other input of this AND-gate. When the inverter -select switch is moved 
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from the off position, the inhibit voltage is removed immediately and the inverter cau- 
tion light is illuminated with an accompanying master alarm. The inverter light is not 
extinguished until after the inverter voltage has been processed by the SCEA and the 
CWEA and an in -limits voltage and an in-limits frequency have been established. 


Corrective Action for LM-3 and LM-4 

No hardware change will be implemented. During vehicle ground checkout, an 
inverter caution should be expected when an inverter is selected from the off position. 

For flight operation, a procedural change — to select an inverter before closing 
the CWEA circuit breaker — has been incorporated in the AOH. 


Corrective Action for LM-5 and Subsequent Vehicles 

Removal of inhibit voltage is delayed until inverter voltage has been proc- 
essed by the SCEA and the CWEA. The delay is incorporated into CWEA part 
number LSC-360-8-11-9. 

RENDEZVOUS RADAR DATA-NO-GOOD CAUTION 
Characteristic 

A master alarm occurs when the rendezvous radar (RR) mode -select switch is 
placed in the "auto track" position. 


Discussion 

When the RR mode -select switch is placed in the auto track position, the range - 
tracker circuit and the CWEA are enabled. A no -track signal is sent to the CWEA, and 
a master alarm is initiated. The RR caution light remains on until the range tracker 
locks on to the radar return signals and the no -track signal is removed from the CWEA. 


Corrective Action for LM-3 and LM-4 

No hardware change is incorporated (fig. 28). A procedural change has been in- 
corporated in the AOH to alert the crew to expect occurrence of and to reset the master 
alarm when placing the RR mode -select switch in the auto track position. A similar 
procedure should be used for vehicle ground checks. 
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(a) Early landing radar logic. (b) Early rendezvous radar logic. 


Figure 28. - Radar data -no -good indicators for LM-3 and LM-4. 


Corrective Action for LM-5 and Subsequent Vehicles 

A wiring change in the vehicle harness to interchange the RR and l a n ding radar 
(LR) CWEA logic circuits has been incorporated (fig. 29). The logic now used by the 
RR requires that a data -good signal be established to enable the CWEA. Therefore, a 
master alarm cannot be initiated when the RR mode -select switch is placed in the auto 
track position during track acquisition. Once track is established and a data -good sig- 
nal is issued, the CWEA logic is enabled and will activate the master alarm if a subse- 
quent loss of track occurs. 
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(a) Revised landing radar logic. 

Figure 29. - Radar data-no-good indicators for LM-5 and subsequent vehicles. 
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(b) Revised rendezvous radar logic. 

Figure 29.- Concluded. 

LANDING RADAR DATA-N0-G00D CAUTION 
Characteristic 

When the primary guidance and navigation section/LR circuit breaker is opened, 
a master alarm occurs. 


Discussion 

When power is removed from the LR, the data -good relay contacts open a few 
milliseconds before the power-on relay contacts. 


Corrective Action for LM-3 and LM-4 

The LR equipment installed on LM-3 and LM-4 has been modified to provide both 
velocity and range data -good signals to the CWEA (fig. 28) during all modes of radar 
operation. As a result, the only master alarm that should be generated by the LR 
equipment for these vehicles is the one described previously. 

A procedural change has been incorporated in the AOH to inform the crew to ex- 
pect occurrence of and to reset the master alarm when the LR is powered down. A 
similar procedure should be used during vehicle ground checkout. 


Corrective Action for LM-5 and Subsequent Vehicles 

The LR measurement has been removed from the CWEA (fig. 29) because of a 
high probability that an undesirable alarm would occur during the hover maneuver of 
the landing approach. 
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EXPLOSIVE DEVICES MALFUNCTION CAUTION 


Characteristic 1 

An explosive devices (ED) malfunction alarm occurs when the abort stage switch 
is reset after staging. 

Discussion. - When the abort stage switch (fig. 30) is depressed, ED relay K1 is 
set and the ED bus is armed. This action completes the contact closure path in the 
relay "daisy chain" (relays K1 to K6) and provides an input to the CWEA. The master 
alarm does not operate, however, because S&C relay K19 also is energized by the 
abort stage switch and inhibits the CWEA. A third set of contacts on the abort stage 
switch signals the CES to issue a stage command. This stage command from the CES 
sets relay K2, which initiates staging by sequentially energizing relays K3 to K6. 



Note: DT * delay timer 
L ■ low 
H • high 


Figure 30. - Explosive devices subsystem stage sequence failure -detection circuit. 
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Resetting the abort stage switch after staging removes the inhibit voltage from the 
CWEA by deenergizing relay K19. Relay K1 is reset, removing the +28 volts from the 
ED bus and deenergizing relays K3 to K6. Relay K2 has no automatic -reset capability 
and, therefore, completes the closed-contact path to the SCEA input, activating the 
master alarm. 

Corrective action for LM-3 and subs equent vehicles. - No hardware change will 
be implemented. A procedural change has been incorporated in the AOH to place the 
master arm switch in the on position before resetting the abort stage switch. This ac- 
tion will inhibit the CWEA. The ED logic A and B circuit breakers are to be opened 
after staging to remove any unnecessary power drain. The same procedure should be 
used during vehicle ground testing. 


Characteristic 2 

An ED malfunction alarm occurs when the master arm switch is moved from ON 
to OFF at the completion of normal staging sequence. 

Discussion. - During normal staging, placing the master arm switch in the on 
position inhibits the CWEA and arms the ED bus by setting relay Kl. Staging can be 
accomplished automatically by firing the ascent engine or manually by closing the stage 
switch without firing the ascent engine. In either case, relay K2 is set and initiates the 
staging sequence. At the completion of staging, if the master arm switch is placed in 
the off position, the inhibit voltage is removed from the CWEA and relay Kl is reset, 
causing reconfiguration of relays K3 to K6. Relay K2 has no automatic reset; thus, it 
completes the closed-contact path to the SCEA and activates the master alarm. 

Corrective action for LM-3 and subsequent vehicles . - A procedural change has 
been incorporated in the AOH to leave the master arm switch in the on position after 
staging to inhibit the CWEA. The ED logic A and B circuit breakers are to be opened 
after staging to remove any unnecessary power drain. 


Characteristic 3 

An ED malfunction alarm occurs when the master arm switch is moved from ON 
to OFF at the completion of any ED function other than staging. 

Discussion. - Relay K2 is not set during ED functions that do not involve staging. 
This alarm condition is of short duration and exists during the time required to reset 
relay Kl, after the inhibit voltage has been removed from the CWEA. 

Corrective action fo r LM-3 and LM-4. - A procedural change to the AOH has been 
incorporated to inform the crew to expect the occurrence of and to reset the master 
alarm. A similar procedure should be used during ground check. 

Corrective action for LM-5 and su bsequent vehicles. - Removal of inhibit voltage 
is delayed while relay Kl is reset. This change is incorporated into CWEA part num- 
ber LSC -360-8-11 -9. 
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With the hardware change incorporated in the CWEA to delay the removal of the 
inhibit voltage when relay K19 is deenergized or the master arm switch is placed in the 
off position, it is recognized that manually resetting relay K2 after staging also would 
prevent the occurrence of a master alarm. However, any subsequent engine firing 
would set relay K2 and initiate a master alarm. 


HEATER CAUTION (RCS QUAD-CLUSTER TEMPERATURES) 


As a result of data obtained during the LM-3 flight and subsequent RCS red -line - 
temperature ground tests, the following design changes have been implemented. 


Design Change for LM-4 

The CWEA trip levels for the RCS quad-cluster temperature measurements have 
been changed to 113° and 241° F. During certain phases of the mission (such as dock- 
ing), a master alarm is still possible and should be expected during normal procedures. 
This possible master alarm will be noted in the LM-4 AOH procedures. 


Design Change for LM-5 and Subsequent Vehicles 

The RCS quad -cluster temperatures have been deleted from the CWEA by cutting 
the interface wiring between the SCEA and the CWEA. This change will cause a heater 
caution indication and a master alarm when the CWEA circuit breaker is initially closed 
and will be included as an expected master alarm in the AOH procedures. The heater 
caution light must be reset by rotating the temperature monitor switch through the four 
RCS quad temperature positions. 


HEATER CAUTION (LR ANTENNA TEMPERATURES) 


Characteristic 1 

Characteristic 1 is caused by the lack of a staging enable to the CWEA logic 
(fig. 31). When vehicle staging is performed, the wiring to the LR temperature sensor 
is severed by the cable cutter. This operation places an open circuit at the input to 
the SCEA, which is analogous to an out- of -temperature condition at the high end; and 
the CWEA initiates a master alarm. 
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Corrective action for LM-3 and 
LM-4. - To preclude the issuance of a mas- 
ter alarm during staging, the LR tempera- 
ture interface was removed between the 
SCEA and the CWEA. This modification 
will cause a master alarm when the CWEA 
circuit breaker is closed; however, be- 
cause a master alarm is assured when the 
CWEA is activated during the mission as a 
result of the incapability of the RCS quad 
heaters to establish an in-limits condition 
before activation, the master alarm is of 
no significance. The LR heater caution can 
be reset by rotating the temperature moni- 
tor switch to the LR antenna position. 

After resetting, the circuit is disabled for 
the remainder of the mission, unless the 
CWEA is turned off and then back on. This 
cycling of the CWEA circuit breaker would 
require resetting the LR heater caution. 

Corrective action for L M-5 and 
subsequent vehicles . - A staging-enable 
circuit was added to the LR temperature 
logic (internal to CWEA part number 
Figure 31. - Heater caution circuit. LSC-360-8-11-9) to inhibit this circuit at 

staging. Subsequent to this change, two 
other undesirable characteristics of this circuit were identified. During touchdown 
on a lunar landing mission, heat from the descent engine plume will be reflected back 
to the LR antenna from the lunar surface. This heat will cause the LR antenna temper- 
ature to go beyond the upper limits and initiate a master alarm during a period of high 
activity. After landing, the LR electronics and antenna heater circuit breakers are 
opened to conserve battery power. Following an undetermined period of cold soak on 
the lunar surface, the antenna temperature would gradually decrease to an in-limits 
condition, remove the failure indication to the CWEA, and enable it for future failures. 
The antenna temperature would continue to decrease until it eventually reached the out- 
of -limits condition on the low end and would initiate a second master alarm. 

A high probability exists that this second alarm condition could occur during an 
EVA period. The master alarm would alert the ground crew to a failure that could be 
identified; however, with both crewmembers on EVA, the master alarm could not be 
reset and, thus, could not be used as a cue to ground personnel in the event of a sub- 
sequent failure. 

Because both of these alarm conditions would occur when the LR equipment was 
no longer required, they could serve only to hinder the completion of the mission. As 
a result, measurement of LR antenna temperature has been removed from the CWEA. 
This modification was accomplished by removing the stage enable at the input to the 
CWEA. 
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The following measurements are OR -gated inputs to GL4053. 


1. GR6001T (LM-4 only) — quad cluster number 4 temperature (<113° and 
>241° F) 

2. GR6002T (LM-4 only) — quad cluster number 3 temperature (<113° and 
>241° F) 

3. GR6003T (LM-4 only) — quad cluster number 2 temperature (<113° and 
>241° F) 

4. GR6004T (LM-4 only) — quad cluster number 1 temperature (<113° and 
>241° F) 

5. GN7723T — RR antenna temperature (< -54. 1 ° and > 147. 7° F) 

6. GT0454T — S-band antenna assembly temperature (< -64. 1 ° and >152. 6° F) 


Characteristic 2 

An in-limits temperature condition first must be established to enable the CWEA 
to detect a failed -off heater (fig. 31). The antenna heaters are activated before lift-off 
and are, therefore, not affected by this characteristic during flight. 

Discussion. - An in -limits temperature condition for the parameters identified 
previously will produce a logic zero at the output of the detectors (fig. 31). An out- 
of- limits temperature condition on any of these parameters will produce a logic one 
at the output of its associated detector. A transition from a logic zero (in- limits con- 
dition) to a logic one (out- of- limits condition) at the detector output is required to set 
a flip-flop. When any flip-flop is set, the heater caution light is turned on and a master 
alarm is initiated. The caution light can be extinguished manually by resetting the flip- 
flop with temperature monitor select switch 18S10. However, the failed indication (a 
logic one) still remains at the output of the detector and can be removed only by es- 
tablishing an in- limits temperature condition (logic zero). 

During LM missions, the RCS quad heaters are turned on after the crew transfers 
to the LM. The CWEA is turned on after activation of the heaters but before the quad 
temperatures have reached a normal operating level. Therefore, a failed indication 
(logic one) exists at the output of the low-level detectors and all four quad-cluster 
flip-flops are set when the CWEA is turned on. The flip-flops are reset manually by 
rotating switch 18S10, but the logic ones at the output of the detectors effectively in- 
hibit the CWEA until the heaters raise the quad temperatures to within normal limits. 

If a heater should fail off before an in-limits condition is established, the failure will 
not be detected by the CWEA. 

Corrective action for LM-3 and LM-4 . - The crew is instructed by the AOH to 
periodically monitor the quad -cluster temperatures after turn-on, to verify that the 
temperatures have reached an in-limits condition. Once this condition has been estab- 
lished, the CWEA is enabled and will detect any subsequent heater failures. 
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POSSIBLE MASTER ALARM RESULTING FROM CARBON 
DIOXIDE SENSOR (ECS CAUTION) 


Discussion 

A master alarm may occur during 
vehicle ground checkout when the carbon 
dioxide (COg) sensor circuit breaker is 

closed (fig. 32). This possibility results 
from a transient voltage produced by the 
CO„ sensor when power is applied. The 

magnitude of this transient voltage varies 
with COg sensors and may not be sufficient 

to trip the ECS caution light and produce a 
master alarm. A master alarm resulting 
from this characteristic has been experi- 
enced only during checkout of one vehicle 
(LM-4). 
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Figure 32. - Typical plot of carbon 
dioxide pressure variation during 
ground checkout. 


Corrective Action for LM-3 and Subsequent Vehicles 


The COg sensor characteristic will not cause a master alarm during inflight 

checkout of the vehicle if existing AOH procedures are followed. Existing procedures 

call for closing the CO„ sensor circuit breaker before the master alarm circuit breaker 

z 

is closed. During ground checkout, a master alarm may occur if the COg sensor 
breaker is closed after the CWEA and master alarm breakers are closed. 


S-BAND RECEIVER (AUTOMATIC GAIN 
CONTROL ALARM) CAUTION 

Discussion 

At the completion of the S-band rang- 
ing function, the S-band range -function 
switch (13S1) is placed in the off/reset po- 
sition (fig. 33). This action will reset the 
S-band caution circuit. However, any sub- 
sequent decrease of the S-band automatic 
gain control (AGC) voltage (as a result of 
signal fading) below the CWEA reference 
level, while the switch remains in the off/ 
reset position, will register a failure in the 
CWEA memory. Subsequent enabling of the 
S-band caution indicator would cause a 
master alarm. 



13S1 

Range-function 

switch 


Figure 33. - S-band receiver AGC 
failure -detection circuit. 
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Corrective Action for LM-3 and Subsequent Vehicles 

This condition can be avoided by placing the S-band range -function switch momen- 
tarily in the range position immediately prior to enabling the CWEA. This action will 
reset the S-band caution circuit and remove any prior failures. 


LOW DESCENT PROPELLANT QUANTITY WARNING 


Characteristic 1 

A high probability exists for the occurrence of a master alarm during a normal 
lunar landing. 

Discussion. - The GL4024 warning indication (fig. 34) was designed to alert the 
crew to a propellant quantity remaining equal to 2 minutes at 25 percent thrust. There 
is a high probability that the propellant level will reach this point prior to touchdown on 
a normal lunar landing. 


From 

low- 

level 

sensors 



(a) For LM-3 and LM-4. 


From 

low- 

level 

sensors 
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(b) For LM-5 and subsequent vehicles. 

Figure 34. - Descent propellant low-level quantity circuit. 








Corrective action for LM-4. - No corrective action is required for the ”F" (lunar 
orbit) mission. The master alarm will be initiated when the descent propellant level is 
equal to a 2 -minute engine burn at 25 percent thrust. 

Corrective action for LM-5 and subse quent vehicles. - The low descent propellant 
quantity measurement has been removed from the CWEA and the master alarm circuits. 
The low-level quantity annunciator light has been retained for this measurement on the 
caution and warning array, and this light will illuminate when the propellant remaining 
is equal to 2 minutes at 25 percent thrust. This visual indication will not be accom- 
panied by a master alarm. 


Characteristic 2 

A possible low-level indication is anticipated prior to the ullage maneuver. 

Discussion. - If the descent propellant quantity gaging system (PQGS) is activated 
before performance of the ullage maneuver, the four low-level sensors in the PQGS 
may be exposed to the ullage (fig. 34). Should any one of these four sensors be exposed 
to ullage, a low-level indication is latched in the PQGS control unit. On LM-5 and sub- 
sequent vehicles, this condition will illuminate the annunciator light on the CWEA array. 
A master alarm will not occur. On LM-4, because of logic circuitry in the CWEA, this 
condition will go unnoticed until a descent engine -on command is initiated; thus, a mas- 
ter alarm and a low-level quantity warning will occur when the engine is commanded to 
fire. 


Corrective act ion for LM-4. - Two possible courses of action are available. 

1. Recycle the PQGS after the ullage maneuver is performed and before the first 
descent engine -on command is initiated. 

2. Expect a possible master alarm when the descent engine is initially fired, 
verify that the descent quantity light is on, and reset the master alarm. 

The LM-4 AOH procedures identify this condition and specify the second course of 
action. 

Corrective action for LM-5 and subsequent vehicles. - The AOH procedure calls 
for recycIingThe PQGS subsequent to the ullage maneuver, if the descent quantity light 
is on. 


NASA-Langley, 1972 31 S-294 
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